Let denotes the fraction of shortest paths between u and w that contain vertex v:

where denotes the number of all shortest-paths between u and w. The ratio can be interpreted as the probability that vertex v is involved into any communication between u and w. Note, that
the measure implicitly assumes that all communication is conducted along shortest paths. Then the betweenness centrality of a vertex v is given by:

Any pair of vertices u and w without any shortest path from u to w will add zero to the betweenness centrality of every other vertex in the network.

Let denote the fraction of shortest paths between s and t that contain vertex v:

where denotes the number of all shortest-path [sic] between s and t. Ratios can be interpreted as the probability that vertex v is involved into any communication between s and t. Note, that the index implicitly assumes that all communication is conducted along shortest paths. Then the betweenness centrality of a vertex v is given by:

[page 30]

[...]

Any pair of vertices s and t without any shortest path from s to t just will add zero to the betweenness centrality of every other vertex in the network.

Anmerkungen

The definitions given here are, of course, standard and don't require a citation. However, the interpreting and explaining text is taken from the source word for word. The source is not mentioned in the paper anywhere.

We denote the sum of the distances from a vertex u ∈ V to any other vertex in a graph G = (V,E) as the total distance , where d(u,v) is shortest [sic] distance between the nodes u and v The problem of finding an appropriate location can be solved by computing the set of vertices with minimum total distance.

In SNA literature, a centrality measure based on this concept is called closeness.
The focus lies here, for example, on measuring the closeness of a person to all other
people in the network. People with a small total distance are considered as most
important as those with high total distance. The most commonly employed definition
of closeness is the reciprocal of the total distance:

grows with decreasing total distance of u, therefore it is also
known as a structural index.

We denote the sum of the distances from a vertex u ∈ V to any other vertex in a graph G = (V,E) as the total distance2. The problem of finding an appropriate location can be solved by computing the set of vertices with minimum total distance. [...]

In social network analysis a centrality index based on this concept is called closeness. The focus lies here, for example, on measuring the closeness of a person to all other people in the network. People with a small total distance are considered as more important as those with a high total distance. [...] The most commonly employed definition of closeness is the reciprocal of the total distance

[page 23]

In our sense this definition is a vertex centrality, since ') grows with decreasing total distance of u and it is clearly a structural index.

2 In [273], Harary used the term status to describe a status of a person in an organization or a group. In the context of communication networks this sum is also called
transmission number.

Now we define dependence centrality as the degree to which a node, u, must depend upon another, v, to relay its messages along geodesics to and from all other reachable nodes in the network. Thus, for a network containing n nodes, the dependence centrality of u on v can be found by using: [...]

We can calculate the dependence centrality of each vertex on every other vertex in
the network and arrange the results in a matrix [...]

Now we can define pair-dependency as the degree to which a point, pi, must depend upon another, pj, to relay its messages along geodesics to and from all other reachable points in the network. Thus, for a network containing n points, [...]

We can calculate the pair-dependencies of each point on every other point in the network and arrange the results in a matrix,

Anmerkungen

The notion of pair-dependency, which has been known for some time, is called "dependence centrality" in this paper (the used formula is a slight adaptation of the original formula). A source is not mentioned, although some text appears to have been taken from this paper.

(1) The chain network, as in a smuggling chain, where people, goods, or information move along a line of separated contacts and where end-to-end communication must travel through the intermediate nodes. (2) The star, hub, or wheel network, as in a terrorist syndicate or a cartel structure, where a set of actors is tied to a central node or actor and all must go through that node to communicate and coordinate with each other. (3) The all-channel network, as in a collaborative network of small militant groups, in which every group or node is connected to every other node.

Each type of network may be suited to different conditions and purposes, and there may be any number of hybrids. The all-channel network has historically been the most difficult to organize and sustain, partly because of the dense communications required. Yet the all-channel network is the type that is gaining strength from the information revolution. The design is flat. Ideally, there is no single, central leadership or command or headquarters—-no precise heart or head that can be targeted. Decision-making and operations are decentralized, allowing for local initiative and autonomy [10].

The chain or line network, as in a smuggling chain where people, goods, or information move along a line of separated contacts, and where end-to-end communication must travel through the intermediate nodes.

The hub, star, or wheel network, as in a franchise or a cartel where a set of actors are tied to a central (but not hierarchical) node or actor, and must go through that node to communicate and coordinate with each other.

[page 8]

[FIGURE]

The all-channel or full-matrix network, as in a collaborative network of militant peace groups where everybody is connected to everybody else.

[...]

Each type may be suited to different conditions and purposes, [...] There may also be hybrids of the three types,[...]

[page 9]

Of the three network types, the all-channel has been the most difficult to organize and sustain, partly because it may require dense communications. But it is the type that gives the network form its new, high potential for collaborative undertakings and that is gaining new strength from the information revolution. [...] The organizational design is flat. Ideally, there is no single, central leadership, command, or headquarters—-no precise heart or head that can be targeted. [...] Decisionmaking and operations are decentralized, allowing for local initiative and autonomy.

Anmerkungen

The source is given at the beginning, but it is not clear to the reader that the source is being followed verbatim at times and also in one paragraph further down.

Each entry in D is an index of the degree to which the node designated by the row of the matrix must depend on the vertex designated by the column to relay messages to and from others. Thus D captures the importance of each node as a gatekeeper with respect to each other node — facilating [sic] or perhaps inhibiting its communication.

Each entry in D is an index of the degree to which the point designated by the row of the matrix must depend on the point designated by the column to relay messages to and from others. Thus D captures the importance of each point as a gatekeeper with respect to each other point — facilitating or perhaps inhibiting its communication.

Anmerkungen

Apart from the substitution "node"/"vertex" <--> "point" the text is identical. The source is not mentioned anywhere in the paper.

IDM also endows the analyst with the ability to measure the level of covertness and efficiency of the cell as a whole, and the level of activity, ability to access others, and the level of control over a network each individual possesses. The measurement of these criteria allows specific counter-terrorism applications to be drawn, and assists in the assessment of the most effective methods of disrupting and neutralising a terrorist cell [13]. In short, IDM provides a useful way of structuring knowledge and framing further research. Ideally it can also enhance an analyst’s predictive capability [13].

The method also endows the analyst the ability to measure the level of covertness and efficiency of the cell as a whole, and also the level of activity, ability to access others, and the level of control over a network each individual possesses. The measurement of these criteria allows specific counter-terrorism applications to be drawn, and assists in the assessment of the most effective methods of disrupting and neutralising a terrorist cell.

[page 3]

In short, social network analysis “provides a useful way of structuring knowledge and framing further research. Ideally it can also enhance an analyst’s predictive capability”.12

The authors refer to one of their own earlier papers (see SpringerLink). There the passage can indeed be found, but Koschade (2005) was published even before the Memon/Larson paper. Thus, it cannot be the original source.

The authors also removed a citation and attribute the quote to themselves.

Terrorists seldom operate in a vacuum but interact with one another to carry out terrorist activities. To perform terrorist activities requires collaboration among
terrorists. Relationships between individual terrorists are essential for the smooth
operation of a terrorist organization, which can be viewed as a network consisting of
nodes (for example terrorists, terrorist camps, supporting countries, etc.) and links (for example, communicates with, or trained at, etc.). In terrorist networks, there may exist some group or cell, within which members have close relationships. One group may also interact with other groups. For example, some key nodes (key players) may act as leaders to control activities of a group, while others may serve as gatekeepers to ensure smooth flow of information or illicit goods.

1 Introduction

Criminals seldom operate in a vacuum but interact with one another to carry out various
illegal activities. In particular, organized crimes such as terrorism, drug trafficking,
gang-related offenses, frauds, and armed robberies require collaboration among offenders. Relationships between individual offenders form the basis for organized crimes [18] and are essential for smooth operation of a criminal enterprise, which can be viewed as a network consisting of nodes (individual offenders) and links (relationships). In criminal networks, there may exist groups or teams, within which members have close relationships. One group also may interact with other groups to obtain or transfer illicit goods. Moreover, individuals play different roles in their groups. For example, some key members may act as leaders to control activities of a group. Some others may serve as gatekeepers to ensure smooth flow of information or illicit goods.

Anmerkungen

The source is not mentioned, although the beginning of the introduction of the paper is only a version of the introduction of the source, adapted from criminal networks to terrorist networks.

Network researchers have distinguished between strong ties (such as family and friends) and weak ties such as acquaintances [2, 3]. This distinction will involve a multitude of facets, including affect, mutual obligations, reciprocity, and intensity. Strong ties are particularly valuable when an individual seeks socio-emotional support and often entail a high level of trust. Weak ties are more valuable when individuals are seeking diverse or unique information from someone outside their regular frequent contacts.

Ties may be non directional (for example, Atta attends a meeting with Nawaf Alhazmi) or vary in direction (for instance, Bin Laden gives advice to Atta vs. Atta gets advice from Bin Laden). They may vary in content (Atta talks with Khalid about the trust of his friends in using them as human bombs and his recent meeting with Bin Laden), frequency (daily, weekly, monthly, etc.), and medium (face-to-face conversation, written memos, email, fax, instant messages, etc.). Finally ties may vary in sign, ranging from positive (Iraqis like Zarqawi) to negative (Jordanians dislike Zarqawi).

Network researchers have distinguished between strong ties (such as family and friends) and weak ties (such as acquaintances) (Granovetter, 1973, 1982). This distinction can involve a multitude of facets, including affect, mutual obligations, reciprocity, and intensity. Strong ties are particularly valuable when an individual seeks socioemotional support and often entail a high level of trust. Weak ties are more valuable when individuals are seeking diverse or unique information from someone outside their regular frequent contacts. This information could include new job or market opportunities.

Ties may be nondirectional (Joe attends a meeting with Jane) or vary in direction (Joe gives advice to Jane vs. Joe gets advice from Jane). They may also vary in content (Joe talks to Jack about the weather and to Jane about sports), frequency (daily, weekly, monthly, etc.), and medium (face-to-face conversation, written memos, e-mail, instant messaging, etc.). Finally, ties may vary in sign, ranging from positive (Joe likes Jane) to negative (Joe dislikes Jane).

Granovetter,M. (1973). The strength of weak ties. American Journal of Sociology, 81, 1287-1303.

In social network literature, researchers have examined a broad range of types of ties [1]. These include communication ties (such as who talks to whom or who gives information or advice to whom), formal ties (such as who reports to whom), affective ties (such as who likes whom, or who trust whom), material or work flow ties (such as who gives bomb making material or other resources to whom), proximity ties (who is spatially or electronically close to whom). Networks are typically multiplex, that is, actors share more than one type of tie. For example, two terrorists might have a formal tie (one is a foot-soldier or a newly recruited person in the terrorist cell and reports to the other, who is the cell leader) and an affective tie (they are friends); and [may also have a proximity tie (they are residing in the same apartment and their flats are two doors away on the same floor).]

Network researchers have examined a broad range of types of ties. These include communication ties (such as who talks to whom, or who gives information or advice to whom), formal ties (such as who reports to whom), affective ties (such as who likes whom, or who trusts whom), material or work flow ties (such as who gives money or other resources to whom), proximity ties (who is spatially or electronically close to whom), and cognitive ties (such as who knows who knows whom). Networks are typically mutiplex [sic], that is, actors share more than one type of tie. For example, two academic colleagues might have a formal tie (one is an assistant professor and reports to the other, who is the department chairperson)

[page 309]

and an affective tie (they are friends) and a proximity tie (their offices are two doors away).

The source is not mentioned anywhere in this paper, although the text has been taken from the source and adapted to terrorist networks. One of the authors of reference 1 is, however, co-author in Katz, et al. But this exact wording is not to be found in Monge & Contractor, only in Katz, et al.

IDM offers the ability to map a covert cell, and to measure the specific structural and interactional criteria of such a cell. This framework aims to connect the dots between individuals and to map and measure complex, covert, human groups and organizations [13]. The method focuses on uncovering the patterning of people’s interaction, and correctly interpreting these networks assists in predicting behaviour and decision-making within the network [13].

Social network analysis offers the ability to firstly map a covert cell, and to secondly measure the specific structural and interactional criteria of such a cell.

[page 3]

This framework aims to connect the dots between individuals and “map and measure complex, sometimes covert, human groups and organisations”.8 The method focuses on uncovering the patterning of people’s interaction,9 and correctly interpreting these networks assists “in predicting behaviour and decision-making within the network”.10

The authors refer to one of their own earlier papers (see SpringerLink). There the passage can indeed be found, but Koschade (2005) was published even before the Memon/Larson paper. Thus, the Memon/Larson paper cannot be the original source.

The degree centrality Cd(v) of a vertex v is simply defined as the degree d(v) of v if the considered graph is undirected. The degree centrality is, e.g., applicable whenever the graph represents something like a voting result. These networks represent a static situation and we are interested in the vertex that has the most direct votes or that can reach most other vertices directly. The degree centrality is a local measure, because the centrality value of a vertex is only determined by the number of its neighbors.

The most simple centrality is the degree centrality cD(v) of a vertex v that is simply defined as the degree d(v) of v if the considered graph is undirected. [...] The degree centrality is, e.g., applicable whenever the graph represents something like a voting result. These networks represent a static situation and we are interested in the vertex that has the most direct votes or that can reach most other vertices directly. The degree centrality is a local measure, because the centrality value of a vertex is only determined by the number of its neighbors.

A review of key centrality concepts can be found in the papers by Freeman et al. [23]. Their work has significantly contributed to the conceptual clarification and theoretical application of centrality. He provides three general measures of centrality termed “degree”, “closeness”, and “betweenness”. His development was partially motivated by the structural properties of the center of a star graph. The most basic idea of degree centrality in a graph is the adjacency count of its constituent nodes.

A review of key centrality concepts can be found in the papers by Freeman (1979a,b). His work has significantly contributed to the conceptual clarification and theoretical application of centrality. Motivated by the work of Nieminen (1974), Sabidussi (1966), and Bavelas (1948) he provides three general measures of centrality termed

[page 3]

“degree”, “closeness”, and “betweenness”. His development is partially motivated by the structural properties of the center of a star graph. The most basic idea of point centrality in a graph is the adjacency count of its constituent points. “

The reference to Freeman et al. is to a different paper, a group work that does not deal with centrality concepts. Interestingly, referring to the authors the next sentence speaks of "Their", the one after that of "He", and then "His", which parallels the sentences in Stephenson & Zelen. The word "point" has been replaced by "node". Stephenson & Zelen 1989 are not mentioned anywhere in the paper.

The third measure is betweenness which is defined as the frequency at which a node occurs on geodesics that connect pairs of nodes. Thus, any node that falls on the shortest path between other nodes can potentially control the transmission of information or effect exchange by being an intermediary; it is the potential for control that defines the centrality of these nodes [23].

The third measure is called betweenness and is the frequency at which a point occurs on the geodesic that connects pairs of points. Thus, any point that falls on the shortest path between other points can potentially control the transmission of information or effect exchange by being an intermediary. “It is this potential for control that defines the centrality of these points” (Freeman 1979a: 221).

The authors replace "point" with "node" and remove the quotation marks of the Freeman quote, although a different Freeman paper is cited that does not actually discuss "betweenness" at all. Stephenson & Zelen (1989) are not mentioned.

We have attempted to illustrate the calculation of centralities to these prototypical situations. However we regard our efforts in this direction as only a beginning. We only considered shortest distances in this paper. It is quite possible that information will take a more circuitous route either by random communication or may be intentionally channeled through many intermediaries in order to “hide” or “shield” information in a way not captured by geodesic paths. These considerations raise questions as to how to include all possible paths in a centrality measure.

It is quite possible that information will take a more circuitous route either by random communication or may be intentionally channeled through many intermediaries in order to “hide” or “shield” information in a way not captured by geodesic paths. These considerations raise questions as to how to include all possible paths in a centrality measure.

[page 27]

We have attempted to illustrate the calculation of centralities to these prototypical situations. However we regard our efforts in this direction as only a beginning.

SNA primarily focuses on applying analytic techniques to the relationships between individuals and groups, and investigating how those relationships can be used to infer additional information about the individuals and groups [14]. There are a number of mathematical and algorithmic approaches that can be used in SNA to infer such information, including connectedness and centrality [15].

Law enforcement personnel have used social networks to analyze terrorist
networks [16, 17] and criminal networks [6]. The capture of Saddam Hussein was
facilitated by social network analysis: military officials constructed a network
containing Hussein’s tribal and family links, allowing them to focus on individuals
who had close ties to Hussein [19].

6. Sparrow, M.: The Application of Network Analysis to Criminal Intelligence: An
Assessment of the Prospects. Social Networks 13, 251–274 (1991)

Social network analysis (SNA) primarily focuses on applying analytic techniques to the relationships between individuals and groups, and investigating how those relationships can be used to infer additional information about the individuals and groups (Degenne & Forse, 1999). There are a number of mathematical and algorithmic approaches that can be used in SNA to infer such information, including connectedness and centrality (Wasserman & Faust, 1994).

[...] Law enforcement personnel have used social networks to analyze terrorist networks (Krebs, 2006; Stewart, 2001) and criminal networks (Sparrow, 1991). The capture of Saddam Hussein was facilitated by social network analysis: military officials constructed a network containing Hussein’s tribal and family links, allowing them to focus on individuals who had close ties to Hussein (Hougham, 2005).

On the other hand, traditional data mining commonly refers to using techniques rooted in statistics, rule-based logic, or artificial intelligence to comb through large amounts of data to discover previously unknown but statistically significant patterns. However, in the application of IDM in the counterterrorism domain, the problem is much harder, because unlike traditional data mining applications, we must, find an extremely wide variety of activities and hidden relationships among individuals. Table 1 gives a series of reasons for why traditional data mining isn’t the same as investigative data mining.

Data mining commonly refers to using techniques rooted in statistics, rule-based logic, or artificial intelligence to comb through large amounts of data to discover previously unknown but statistically significant patterns. However, the general counterterrorism problem is much harder because unlike commercial data mining applications, we must find extremely rare instances of patterns across an extremely wide variety of activities and hidden relationships among individuals. Table 2 gives a series of reasons for why commercial data mining isn’t the same as terrorism detection in this context.

Although these techniques are powerful, it is a mistake to view investigative data mining techniques as a complete solution to security problems. The strength of IDM is to assist analysts and investigators. IDM can automate some functions that analysts would otherwise have to perform manually. It can help to prioritize attention and focus an inquiry, and can even do some early analysis and sorting of masses of data. Nevertheless, in the complex world of counterterrorism, it is not likely to be useful as the only source for a conclusion or decision.

Although these techniques are powerful, it is a mistake to view data mining and automated data analysis as complete solutions to security problems. Their strength is as tools to assist analysts and investigators. They can automate some functions that analysts would otherwise have to perform manually, they can help prioritize attention and focus an inquiry, and they can even do some early analysis and sorting of masses of data. But in the complex world of counterterrorism, they are not likely to be useful as the only source for a conclusion or decision.

Anmerkungen

The source in mentioned one paragraph above, which is also very much inspired from it. However, there is no indication, implicit or explicit, that this paragraph is also taken from De Rosa (2004).

Structural network patterns in terms of subgroups and individual roles are important in understanding the organization and operation of terrorist networks. Such knowledge can help law enforcement and intelligence agencies to disrupt terrorist networks and develop effective control strategies to combat terrorism. For example, capture of central members in a network may effectively upset the operational network and put a terrorist organization out of action [4, 5, 6]. Subgroups and interaction patterns between groups are helpful in finding a network’s overall structure, which often reveals points of vulnerability [7, 8].

Structural network patterns in terms of subgroups, between-group interactions, and individual roles thus are important to understanding the organization, structure, and operation of criminal enterprises. Such knowledge can help law enforcement and intelligence agencies disrupt criminal networks and develop effective control strategies to combat organized crimes such as narcotic trafficking and terrorism. For exam-

[page 233]

ple, removal of central members in a network may effectively upset the operational network and put a criminal enterprise out of action [3, 17, 21]. Subgroups and interaction patterns between groups are helpful for finding a network’s overall structure, which often reveals points of vulnerability [9, 19].

In the counterterrorism domain, much of the data could be classified. If we are to truly get the benefits of the techniques we need to test with actual data. But not all researchers have the clearances to work on classified data. The challenge is to find unclassified data that is, representative of the classified data. It is not straightforward to do this, as one has to make sure that all classified information, even through implications, is removed. Another alternative is to find as good data as possible in an unclassified setting for researchers to work on. However, the researchers have to work not only with counterterrorism experts but also with data mining specialists who have the clearances to work in classified environments. That is, the research carried out in an unclassified setting has to be transferred to a classified setting later to test the [applicability of data mining algorithms. Only then do we get the true benefit of investigative data mining.]

[page 213]

However for the domain that we are considering much of the data could be classified. If we are to truly get the benefits of the techniques we need to test with actual data. But not all of the researchers have the clearances to work on classified data. The challenge is to find unclassified data that is a representative sample of the classified

[page 214]

data. It is not straightforward to do this, as one has to make sure that all classified
information, even through implications, is removed. Another alternative is to find as
good data as possible in an unclassified setting for the researchers to work on. However,
the researchers have to work not only with counter-terrorism experts but also with data
mining specialists who have the clearances to work in classified environments. That is,
the research carried out in an unclassified setting has to be transferred to a classified
setting later to test the applicability of the data mining algorithms. Only then can we
get the true benefits of data mining.